Direct Syscall in Windows Meterpreter

[dledda-r7]

Direct Syscall in Metsrv

This PR kickstart the usage of the direct syscall implemented by @cdelafuente-r7 in the ReflectiveDllInjection repository. The scopes of this PR are:

Extending the WINAPI

With the initial winapi work we started defining wrappers for system calls for mainly two reasons:

1. remove the system function from the function import
2. be able to control the implementation and use direct syscell when possible

Easier direct-syscall loader

Creation of helpers to speedup the extension of direct syscall.
To add new syscalls we need to include the syscall name and the expected arguments to the NtDllFunction lpFunctionsTobeLoaded array and extend the enum NtDllSyscall with the new system call, then we can proceed with the creation of the wrappers and the optional export to themet_api interface.

This pr include the wrappers for the ~90% of function used within metsrv.
Not all of them has been used and this is outside of the scope of this PR. smaller PRs will be done to cover smaller area of the codebase to speedup the testing.

TODO:

• Make standard wrappers for all the other meterpreter functions
• Expose the Zw Functions on met_api
• Add GetProcAddrH
• Remove strings

Migration with Direct Syscall

DebugString: "[1384] [MIGRATE] Attempting to migrate. ProcessID=1708, Arch=x64"
DebugString: "[1384] [MIGRATE] Attempting to migrate. PayloadLength=291840 StubLength=317"
DebugString: "[1384] [INJECT][supports_poolparty_injection] RtlGetVersion: 00007FFF82EAE4E0"
DebugString: "[1384] [INJECT][supports_poolparty_injection] dwSourceArch: 2 dwDestinationArch: 2"
DebugString: "[1384] [INJECT][supports_poolparty_injection] os.dwMajorVersion: 10 os.dwMinorVersion: 0"
DebugString: "[1384] [MIGRATE] Got SeDebugPrivilege!"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpWinApiSyscalls = 00000000005ECC90"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005ECD00; dwCryptedHash = 00000000D33D4AED"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005EC960; dwCryptedHash = 00000000F0D09D60"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005EC9B0; dwCryptedHash = 00000000C5D0A4C2"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005ECA00; dwCryptedHash = 000000003DEFA5C2"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005ECA50; dwCryptedHash = 00000000BC3F4D89"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005ECAA0; dwCryptedHash = 000000004FD39C92"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] lpSyscall = 00000000005ECAF0; dwCryptedHash = 00000000DE63B5C3"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 0 pStub: 00007FFF82F0D7E8, dwSyscallNr: 24"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 1 pStub: 00007FFF82F0D9A8, dwSyscallNr: 38"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 2 pStub: 00007FFF82F0DC28, dwSyscallNr: 58"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 3 pStub: 00007FFF82F0DCC8, dwSyscallNr: 63"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 4 pStub: 00007FFF82F0DEE8, dwSyscallNr: 80"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 5 pStub: 00007FFF82F0D948, dwSyscallNr: 35"
DebugString: "[1384] [WINAPI][GetOrInitWinApiSyscalls] Index: 6 pStub: 00007FFF82F0D8A8, dwSyscallNr: 30"
DebugString: "[1384] [WINAPI][winapi_kernel32_OpenProcess] Syscall ZwOpenProcess returned: 0"
DebugString: "[1384] [MIGRATE] creating the configuration block"
DebugString: "[1384] [CONFIG] preparing the configuration"
DebugString: "[1384] [CONFIG] Allocating 1036 bytes for transport, total of 1604 bytes"
DebugString: "[1384] [CONFIG] Comms handle set to 00000000000001A4"
DebugString: "[1384] [CONFIG] Total of 1614 bytes located at 0x00000000005D9800"
DebugString: "[1384] [MIGRATE] Config of 1614 bytes stashed at 0x00000000005D9800"
DebugString: "[1384] [MIGRATE] Duplicated Event Handle: 0x3d4"
DebugString: "[1384] [WINAPI][winapi_kernel32_VirtualAllocEx] Syscall ZwAllocateVirtualMemory returned: 0"
DebugString: "[1384] [MIGRATE] Migrate stub: 0x000002C991350000 -> 317 bytes"
DebugString: "[1384] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: 0"
DebugString: "[1384] [MIGRATE] Migrate context: 0x000002C99135013D -> 388 bytes"
DebugString: "[1384] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: 0"
DebugString: "[1384] [MIGRATE] Migrate payload: 0x000002C9913502C1 -> 291840 bytes"
DebugString: "[1384] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: 0"
DebugString: "[1384] [MIGRATE] Configuration: 0x000002C9913976C1 -> 1614 bytes"
DebugString: "[1384] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: 0"
DebugString: "[1384] [INJECT][supports_poolparty_injection] RtlGetVersion: 00007FFF82EAE4E0"
DebugString: "[1384] [INJECT][supports_poolparty_injection] dwSourceArch: 2 dwDestinationArch: 2"
DebugString: "[1384] [INJECT][supports_poolparty_injection] os.dwMajorVersion: 10 os.dwMinorVersion: 0"
DebugString: "[1384] [INJECT][inject_via_poolparty][ntdll_init] NtQueryInformationProcess: 00007FFF82F0D800 NtQueryObject: 00007FFF82F0D6E0"
DebugString: "[1384] [INJECT][inject_via_poolparty][ntdll_init] ZwSetIoCompletion: 00007FFF82F10930"
DebugString: "[1384] [INJECT][inject_via_poolparty] using: poolparty_stub_x64"
DebugString: "[1384] [WINAPI][winapi_kernel32_VirtualAllocEx] Syscall ZwAllocateVirtualMemory returned: 0"
DebugString: "[1384] [INJECT][inject_via_poolparty] ctx [000002C9913A0112] lpStartAddress: 000002C991350000 lpParameter 000002C99135013D hTriggerEvent 00000000000003E0"
DebugString: "[1384] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: 0"
DebugString: "[1384] [WINAPI][winapi_kernel32_WriteProcessMemory] Syscall ZwWriteVirtualMemory returned: 0"
DebugString: "[1384] [INJECT][inject_via_poolparty] Attempting injection with variant POOLPARTY_TECHNIQUE_TP_DIRECT_INSERTION"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] lpProcessInfo: 00000000025FA3A0"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] NtQueryInformationProcess() : 00000000C0000004"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] HeapReAlloc lpProcessInfo: 00000000025FA3A0"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] NtQueryInformationProcess() : 0000000000000000"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] lpProcessInfo: 00000000025FA3A0 dwInformationSizeIn: 9936"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] lpObjectInfo: 00000000025FCAA0"
DebugString: "[1384] [INJECT][inject_via_poolparty][get_remote_handle] hHijackHandle: 00000000000003AC"
DebugString: "[1384] [WINAPI][winapi_kernel32_VirtualAllocEx] Syscall ZwAllocateVirtualMemory returned: 0"
DebugString: "[1384] [INJECT][inject_via_poolparty][remote_tp_wait_insertion] ZwSetIoCompletion: 0"
DebugString: "[1384] [INJECT] inject_via_poolparty: injected!"
DebugString: "[1384] [INJECT] inject_via_poolparty: Sending a migrate response..."
DebugString: "[1384] [TRANSMIT] Sending packet to the server"

[cdelafuente-r7]

Thank you @dledda-r7 ! I'm happy to see metsrv will benefit from Direct Syscalls now. Great job!

I left a few minor comments for you to review when you get a chance.